Herringbone Cat

if you're using a web based proxy redirector ..then well, it'll be evident to the user (albeit less technical ones will not notice), and javascript checks in the browser for URL can call out this attack on the bank side

so yes, if you're using an EvilAP attack to try to catch bank credentials..mitm proxy is going to give you an error once the banks' server gets involved

hey chris. just took a field trip to our roof to let in the AC contractor. oh the joys of information systems management :-)

@ChrisFCarroll I'm not sure how you accomplish (1) without ARP or DNS spoofing? Unless you're describing an "Evil AP" attack where you are the access point, as opposed to hacking pre existing public wifi? In either case, in this scenario the user will see the URL for your proxy server -- as use of mitmproxy or similar tool that wouldn't show your URL would result in a clear certificate error.

@ChrisFCarroll I'm a bit fuzzy on the details of this attack vector..you're talking about spoofing a landing "splash" page for when users join the WiFi network? Or are you talking about staging a CSRF attack? For HSTS, If you had previously visited the site on that device, HSTS would not allow you to access the HTTP version.

@symcbean I'm drawing on experience from Credit Suisse and Citibank specifically, and opinions of director level individuals I interfaced with there. No, I don't work at Google or FB or anything like that.

@symcbean perhaps I should edit my answer to make this more clear, but 3% on a blog site visited by a handful is not a lot, but 3% when you have a few hundred servers is much more significant. I agree though, this is an outdated practice that should be put to rest in favor of TLS-only.

@AndréBorie It's nonsense for small scale sites, but when you're getting large amounts of hits, it translates to huge sums of money in these big environments. <sarcasm> That could be added to the CEO's bonus! </sarcasm>

@GeorgeBailey thanks, I've edited the sentence to read clearer. Sometimes my sed syntax beats my English syntax. :)

@etherealflux and i thought david pogue was a moron, that is just assenine

There's probably at this point far more people making their livelihoods implementing the facebook API, than let's say, implementing RFCs for DNS servers

@DavidFreitag the movement away from standards defined by IETF and putting API and control into hands of private enterprise is a shitty direction the internet has moved in the last decade

I like how @SEJPM probably knows the answer to this but is asking to farm rep since it's a salient new vulnerability :)

This is why I'm hoping to port google glass code into a new product called google ass. It's the first SmartAss. It'll let you share TMI to facebook including your weight before/after poo, etc

@DavidFreitag They are also fond of making you drink a bottle of castor oil and having you poop your brains out for days as a result.

that's what happens when you get mafioso IT support

400000 deployed systems is like a massive chunk of the home internet service in Italy, too

@RоryMcCune agreed..also why I have google drive disabled :) anything you can hit one click and accidently autocomplete a HIPAA violation is no bueno

there's a reason why I don't allow my developers to use github or any non-hosted-by-us repositories.

@MarkBuffalo there are soooo many private keys in github it's ridiculous

:-P

Give me another year.

I'm getting there.

Look more like Kasier Wilhelm here.

I'm trying to grow out my mustache tails.

@ThomasPornin In my defense, I get a lot of right swipes. :)

@ThomasPornin I believe I'm squarely in the third category.

I'd imagine it would require some custom color scheme profiling etc to be actually useful

@ThomasPornin the syntax highlight works well in bash and python but for C, meh

Don't want to be a meme :)

I have a beard, however, I'm careful to shave most of the neck portion.

so the new-schooled bearded unix people could be condescending toward sthe monochrome era people

@ThomasPornin let's not forget vim with ANSI colour

Nano is like a toyota prius with an automatic. Vi is like a freaking rocket ship with a manual transmission and tons of blinking knobs.

yeah sed comes in real handy sometimes, it's the right tool for most script substitution jobs

vi actually taught me sed syntax, which I've used in scripts countless times

@DavidFreitag i thought so too! then i was able to use sed/awk etc in syntax and get stuff done real fast in a pinch. it's one of thsoe things that wasn't ever an issue until i realized it. but that's my experience

@DavidFreitag it's just that nano can't do so much of the command-line oriented stuff vi can.

yes, i spoke just like you at one point. i was like nah i want my pico vi is too much of a PITA. then i had to learn vi because there was no port of nano available on solaris systems I had to admin. never looked back.

@DavidFreitag the thing is vi is very intuitive when you get used to the commands, because it's made for a keyboard w/ no mouse. once you get over the hump it really is awesome.

@DavidFreitag vi would be faster ;)

@Iszi my dad made me learn at 5. so when people put k eyboards on dvorak mode, i'm like "WTF IS THIS?!!? the sky is falling!"

@Iszi actually i'm not..as far as I know, i'm one of the fastest qwerty typists out there ;)

@DavidFreitag the snark is strong in me today

@DavidFreitag that's called echo "text" >>file

like, your speed in vi will be faster than it is in notepad++ etc

@DavidFreitag yeah, really, as just a text editor! so easy to find/replace or to edit inline and move things..once you get use dto it, your speed will increase greatly.

@Iszi highly relevant xkcd ;)

@DavidFreitag believe it or not it'll save you a lot of time because it's so powerful.